Although there are many benefits to this practice, it also goes hand in hand with a glaring shortcoming. When you share sensitive information with a contractor or business partner, you cannot control the environment in which that information is viewed. You’re essentially taking it on faith that a third party will be as careful with mission-critical data as you are.

Given that nearly 40 percent of large enterprises don’t secure their mobile applications, this is a dangerous assumption to make. Whether or not your business is impacted by the latest vulnerability is irrelevant if you’re handing off critical information to other organizations where you’ve no oversight. Even with audits and security inspections, you have very little control over how those outsiders treat your documents – but you’ll still have to bear the consequences if your documents are mishandled.

And outsiders aren’t the only problem, either. Given the right conditions, internal staff can be as much of a liability as contractors. Telecommuting, for example, is on the rise – meaning that employees are more frequently accessing important documents on mobile devices and home networks. Again, this is an environment in which you don’t have full control, and mistakes do happen.

After all, if there’s one universal fact in IT, it’s that the user is eventually going to do something you don’t want them to do.

Securing the file server with encryption and authentication is simply not enough. Effective security controls, such as preventing unauthorized saving, copying and viewing – collectively known as “rights management” – must follow the document wherever it goes starting the instant it leaves the file server.

In short, it’s no longer enough to manage security within the walls of your own business. You also need a document control solution to enable mobile workers and third parties – and to protect your documents from malicious insiders. There are a few things to keep in mind when selecting this solution:

It needs to work on mobile devices: Mobile is a fact of life in enterprise, and that’s not changing any time soon. As evidence, there are very real benefits to enterprise mobility, and they far outshine any risks. People are very likely to access sensitive information on their smartphones and tablets, and your document control solution needs to be accessible to them.

Ease of use must always come first: Enterprise security is, at its core, a constant balancing act between cost, protection, and usability. You need to put the latter first wherever possible, otherwise users are going to undermine your efforts. If your document control solution is obtuse or hard to use, people are going to do whatever they can to avoid using it.

You still need EMM and containers, even with document control: Document control that enables authorized controlled sharing is important, but it’s only one component of organizational security. You still need containers and EMM to prevent mobile device-based data loss that happens when work and personal uses cases commingle on BYOD. Your document control application should mesh well with the systems you’ve already put in place – such as your EMM and container platform.

Most importantly, it impairs neither productivity nor collaboration. Administrators grant access to a document by entering an email, at which point the user types in that email to sign on. Even better, with advanced file share and sync everyone sees the same document, and can edit in tandem. Users can view, create, edit and annotate files on mobile devices with ease.

Security vulnerabilities are always going to exist in enterprise. They’re mitigated easily enough within your own organization, but you cannot control what happens outside your own firewalls. With outsourcing and telecommuting playing such central roles in so many industries, it’s imperative that more organizations start implementing proper document control. Otherwise, they’re just throwing naked documents to the wind, and hoping nothing bad happens because of it.

About Jay Barbour

Jay brings more than 15 years of security experience to BlackBerry where he serves as Security Director for the BlackBerry Security Group. He works closely with government agencies, strategic and carrier sales teams and key customers to champion security policy for BlackBerry mobile devices. Prior to joining BlackBerry, Jay was vice president of marketing at Intrusion Inc., and vice president of product management at Scansafe. Jay holds a degree in Engineering Physics from Queen’s University, Canada, an MBA from INSEAD, France, and is a Certified Information Systems Security Professional (CISSP).

Inside BlackBerry for Business

The views expressed on any corporate or individual's personal website or any Twitter account are not necessarily those of BlackBerry. The user's Twitter account and/or personal website, any corporate website, or any comments contained on any of the foregoing have not been reviewed by BlackBerry and do not constitute an endorsement by BlackBerry.